JP4330547B2 - Information processing system control method, information processing system, information processing system control program, and redundant configuration control device - Google Patents

Abstract

The present invention provides a control method for an information processing system (10), which includes a plurality of processing apparatuses (20),(30) performing a mutually equivalent operation, comprising the step of isolating the processing apparatus (20), (30) for which a fluctuation of power source voltage (V) is relatively large, from the information processing system (10), if an error is not detected in each of the processing apparatuses (20),(30) and respective items of output information from the plurality of processing apparatuses (20),(30) raise a nonidentity.

Description

  The present invention relates to an information processing system control method, an information processing system, an information processing system control program, and a redundant configuration control device, and more particularly, information that improves fault tolerance by causing information processing equivalent to redundant hardware to be performed. The present invention relates to a technology effective when applied to a processing technology.

  For example, in a server system that requires high reliability, in order to increase fault tolerance, even if hardware such as a processor is duplicated and the same information processing is executed by both, an abnormality occurs in one processor. There is known an information processing system having a mirroring function for continuing information processing using an input / output signal of the other processor which is operating normally.

  Processor abnormality detection is performed by parity error or ECC error of input / output data, timeout error of processing operation of each processor, etc., but the above error (abnormality) is not detected in any of the processors operating in duplicate. Nevertheless, when the output signals from both processors do not match, there is no criterion for determining which processor is abnormal. For this reason, when emphasizing reliability, it is necessary to stop the system, and there is a technical problem that the availability of the system is lowered.

  In general, it takes a long time to detect an abnormality in a power supply as compared with the operation speed of a logic circuit such as a processor. For this reason, when using the power supply abnormality detection signal with a large power supply voltage drop that causes the processor to become inoperable, the abnormal system is identified as described above, but both systems appear normal but the output signals match. It will not be a remedy for disability.

  For example, Patent Document 1 includes a first and second CPU having the same configuration, clock means for supplying a clock and a reset signal having the same frequency and the same phase to these CPUs, these two CPUs, and an input / output device. A highly reliable computer including a dual system adapter (DSBA) to be connected and an inter-block communication means for transferring a CPU state and the like between two CPUs is disclosed. The clock means realizes execution of the synchronized program of the two CPUs, and when one of the CPUs breaks down, the dual system adapter disconnects the CPU and allows the other healthy CPU to continue the processing. is there.

  That is, the central DSBA monitors and compares the two CPUs, and accesses a system such as a memory or an I / O by using a signal coming from a CPU that is operating normally.

  In DSBA, the ECC signals, parity checks, etc. of the signals sent from each of the CPUs provided in duplicate are performed, and the error signal for notifying the abnormality detected by the CPU is monitored to check the normality of the CPU. Have confirmed. When the DSBA detects an abnormality of the CPU, it disconnects the system on the side determined to be abnormal and continues the process using only a normal CPU.

  No abnormality is detected for either CPU, but if the signals sent from CPU0 and CPU1 do not match, the system is stopped because it cannot continue or only one of the CPUs is used. Processing will continue.

  In the system of Patent Document 1, when a contradiction occurs in an internal circuit due to a semiconductor failure or a soft error in the CPU, it can be detected by an error detection circuit provided inside, such as a parity check. Further, when an error occurs in the bus between the CPU and the DSBA, it can be detected by performing a parity check or ECC check of the bus at the input of the DSBA or the CPU.

  However, if an abnormality occurs in the power supply that supplies operating power to the CPU, the entire CPU is affected. Therefore, the failure detection circuit in the CPU cannot function normally, and no error signal is output. There is a risk that data will be output to the controller as if it were operating.

  In the case of a power failure, the supply voltage to the CPU falls below the lower limit value at which it can operate normally due to a sudden voltage drop, and after a few milliseconds (ms), the CPU is considered to be in a serious abnormal state. It is possible to determine which CPU has become abnormal. However, when hardware mirroring (CPU multiplexing) is performed, it is necessary to immediately determine an error when different signals are output from the two CPUs, and it is not possible to wait for several milliseconds. Therefore, it is necessary to detect an abnormality in the power supply before the power supply failure reaches the malfunction of the CPU circuit.

  In recent years, power consumption of CPUs has increased, and a dedicated power source is required for each CPU. Therefore, it is necessary to consider the influence of power failure when performing mirroring.

  In Patent Document 2, in a data processing system including a plurality of processing devices and a monitoring device that monitors them, a latch that holds the output of a voltage abnormality detector that monitors the power supply voltage of the processing device is provided. When an abnormality is detected, the monitoring device checks the power supply voltage abnormality by referring to the latch, so that it is possible to confirm the simultaneous detection of the voltage abnormality and the malfunction of the processing device. A technique for realizing clarification of the causal relationship is disclosed.

  However, although the technique disclosed in Patent Document 2 can determine the causal relationship between the voltage abnormality and the malfunction of the individual processing devices, a plurality of faults are not detected in the individual CPUs as described above. A technique for discriminating a faulty CPU in a fault in which the processing results of the CPUs do not match is not disclosed.

  Similarly, Patent Document 3 discloses, in each of the multiplexed processing devices, a power supply state holding unit that monitors the input power supply in the own processing device and stores the presence / absence of power-on due to a momentary interruption, and the like. In response to detection of no response in the other processing device, it is determined whether or not the cause of the non-response is due to the system restart due to a momentary power interruption and the other processing device. And a control unit that resets the state of the power supply state holding unit of the processing apparatus.

  However, even in the technique of Patent Document 3, as in Patent Document 2, although the failure is not detected in the individual CPUs as described above, the failure CPUs in the failure in which the processing results of the plurality of CPUs do not match with each other are detected. Discrimination technology is not disclosed.

Further, Patent Document 4 discloses a computer system including a circuit constituting a computer system, and a failure management system that independently detects a failure state of each circuit and associates the failure state with each circuit. . However, this Patent Document 4 also discloses a technique for determining a faulty CPU in a fault in which processing results of a plurality of CPUs do not match even though the fault is not detected in each CPU as described above. Absent.
JP-A-8-190494 JP-A-57-141731 JP-A-3-266131 Japanese Patent Laid-Open No. 10-143387

  An object of the present invention is to provide a plurality of processing devices in an information processing system that achieves high reliability by causing a plurality of processing devices in a redundant configuration to perform an equivalent operation even though no failure is detected in each processing device. It is to improve the availability of the information processing system in a situation where the output results of these are inconsistent.

A first aspect of the present invention is a method for controlling an information processing system including a plurality of processing devices that perform operations equivalent to each other,
When no error is detected in each of the processing devices and output information from the plurality of processing devices does not match, the processing device on the side where the fluctuation amount of the power supply voltage is relatively large is disconnected from the information processing system. A method for controlling an information processing system is provided.

  According to a second aspect of the present invention, power supply voltage monitoring means is provided in a plurality of processing devices that perform operations equivalent to each other, and no error is detected in each of the processing devices, but output data from the respective processing devices match. If not, a control method for an information processing system is provided in which it is assumed that a failure has occurred in the processing apparatus on the side where the fluctuation amount of the power supply voltage is relatively large.

According to a third aspect of the present invention, in an information processing system including a plurality of first and second processing devices that perform processing equivalent to each other, a fluctuation in power supply voltage of each of the first and second processing devices is detected with a threshold value. Voltage monitoring means for outputting as a voltage monitoring signal,
In the case where the output data from the first and second processing devices does not match even though no abnormality is detected in any of the first and second processing devices, the first from the voltage monitoring means And a control method of an information processing system that refers to the voltage monitoring signal of each of the second processing devices and disconnects the first or second processing device whose power supply voltage indicates an abnormality.

A fourth aspect of the present invention is a control method for an information processing system that causes a plurality of first and second processing devices to perform the same information processing and uses the first or second processing device in a healthy operating state. ,
A first step of determining whether or not an error check item other than the power supply voltage relating to the first and second processing devices is normal;
A second step of determining whether or not the outputs from each of the first and second processing devices match when the error check item is normal;
When the outputs do not match in the second step, the first or second process on the side determined as having no abnormality in the error determination based on the variation amount of the power supply voltage of each of the first and second processing devices A third step using the device;
A method for controlling an information processing system including

A fifth aspect of the present invention provides a plurality of first and second processing devices,
Voltage monitoring means for monitoring fluctuations in the power supply voltage of each of the first and second processing devices;
Selecting means for switching which one of the first and second processing devices to use,
The selection means includes
First determination means for determining whether or not an error check item other than a power supply voltage related to the first and second processing devices is normal;
Second determination means for determining whether or not outputs from each of the first and second processing devices match when the error check item is normal;
When the output is determined to be inconsistent by the second determining means, the first on the side that is determined to have no abnormality in the error determination based on the variation amount of the power supply voltage of each of the first and second processing devices. Or a third discriminating means for selecting the second processing device;
An information processing system including

A sixth aspect of the present invention is a control program for an information processing system including a plurality of first and second processing devices and selection means for switching which of the first and second processing devices to use. And
In the selection means,
A first step of determining whether or not an error check item other than the power supply voltage relating to the first and second processing devices is normal;
A second step of determining whether or not the outputs from each of the first and second processing devices match when the error check item is normal;
When the outputs do not match in the second step, the first or second process on the side determined as having no abnormality in the error determination based on the variation amount of the power supply voltage of each of the first and second processing devices A third step using the device;
A control program for an information processing system for executing

A seventh aspect of the present invention is a redundant configuration control device that monitors a plurality of processing devices provided redundantly in an information processing system and performs an operation of disconnecting the processing device in failure from the information processing system,
An error is not detected in each of the processing devices, but when the output data from each of the processing devices does not match, it is determined that a failure has occurred in the processing device on the side where the fluctuation amount of the power supply voltage is relatively large A redundant configuration control device having control logic is provided.

  According to the above-described present invention, in an information processing system in which a plurality of redundantly configured processing devices perform operations equivalent to each other and a failure occurs in one of the processing devices, the processing is continued using the other healthy processing device. Even in the situation where it is difficult to determine the failure in the conventional case where the processing result of each processing device does not match even though no failure is detected in each processing device, the fluctuation amount of the power supply voltage is relatively large. The processing apparatus on the side is regarded as a failure and disconnected from the system, and the system can be continuously operated using the other healthy processing apparatus, thereby improving the availability of the information processing system.

  According to the present invention, in an information processing system that achieves high reliability by causing a plurality of processing devices in a redundant configuration to perform an equivalent operation, a plurality of processing devices are detected even though no failure is detected in each processing device. It is possible to improve the availability of the information processing system in a situation where the output results of these are inconsistent.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
FIG. 1 is a block diagram illustrating an example of a configuration of an information processing system according to an embodiment of the present invention. FIG. 2 illustrates an internal configuration of a redundant configuration control circuit that configures an information processing system 10 according to the present embodiment. FIG. 3 is an explanatory diagram showing an example of a determination operation in the redundant configuration control circuit of the present embodiment, and FIG. 4 is a diagram of a power supply voltage determination operation in the redundant configuration control circuit of the present embodiment. FIG. 5 is a flowchart showing an example of a determination operation in the redundant configuration control circuit according to the present embodiment.

  The information processing system 10 according to the present embodiment includes a plurality of 0-system processing devices 20 (first processing devices) and 1-system processing devices 30 (second processing devices), a redundant configuration control device 40 (selecting means), and a peripheral system 60. Is included.

The peripheral system 60 includes, for example, a storage device, an input / output device, a communication device, and the like.
The 0-system processing device 20 and the 1-system processing device 30 have the same configuration and perform the same operations that are equivalent to each other. Then, the redundant configuration control device 40 monitors the operations of the 0-system processing device 20 and the 1-system processing device 30 that perform equivalent operations, and performs an operation of connecting one of them to the peripheral system 60. Thereby, even if one of the 0-system processing device 20 and the 1-system processing device 30 fails, the information processing of the information processing system 10 can be continued by selecting the other and connecting it to the peripheral system 60.

The 0-system processing device 20 includes a central processing device 21 (CPU 0), a power supply 22, and a power supply monitoring device 23.
The central processing unit 21 exchanges input / output information 24 with the redundant configuration control device 40. For example, error checking data 25 such as ECC (Error Correcting Code) and parity is added to the input / output information 24, and error detection and correction of the input / output information 24 is performed inside the redundant configuration control device 40.

  The central processing unit 21 has a function of detecting an internal failure that occurs inside itself, and the detection result of this internal failure is transmitted to the redundant configuration control device 40 by an internal error signal 26.

The 1-system processing device 30 includes a central processing unit 31 (CPU 1), a power supply 32, and a power supply monitoring device 33.
The central processing unit 31 exchanges input / output information 34 with the redundant configuration control device 40. For example, error checking data 35 such as ECC (Error Correcting Code) and parity is added to the input / output information 34, and error detection and correction of the input / output information 34 are performed inside the redundant configuration control device 40.

  The central processing unit 31 has a function of detecting an internal failure that occurs inside itself, and the detection result of this internal failure is transmitted to the redundant configuration control device 40 by an internal error signal 36.

  The central processing unit 21 operates with the power supply voltage V supplied from the power supply 22. In the present embodiment, a power supply monitoring device 23 for monitoring fluctuations in the power supply voltage V supplied from the power supply 22 to the central processing unit 21 is provided. The power supply monitoring device 23 includes a detection circuit (not shown) that detects a change in the power supply voltage V at high speed and with high sensitivity. As will be described later, when the power supply voltage V supplied from the power supply 22 to the central processing unit 21 drops below the CPU operable voltage Va, the power supply error signal 23a is output to the redundant configuration control device 40.

  Similarly, the central processing unit 31 operates with the power supply voltage V supplied from the power supply 32. In the present embodiment, a power supply monitoring device 33 that monitors fluctuations in the power supply voltage V supplied from the power supply 32 to the central processing unit 31 is provided. The power supply monitoring device 33 includes a detection circuit (not shown) that detects a change in the power supply voltage V at high speed and with high sensitivity. As will be described later, when the power supply voltage V supplied from the power supply 32 to the central processing unit 31 drops below the CPU operable voltage Va, the power supply error signal 33a is output to the redundant configuration control device 40.

  An example of the configuration of the redundant configuration control device 40 will be described with reference to FIG. The redundant configuration control device 40 of this embodiment includes an error detection / correction circuit 41, an error detection / correction circuit 42, a data comparator 43, an AND circuit 44, an AND circuit 45, an AND circuit 46, and an AND circuit 47. A logical product circuit 48, a logical product circuit 49, and a selector 50. In each signal in FIG. 2 described below, true is “1” and false is “0”.

  In the logic circuit of FIG. 2, the determination of the internal error signal 26 and the internal error signal 36 is omitted. That is, the internal error signal 26 and the internal error signal 36 indicate a more serious failure in the central processing unit 21 and the central processing unit 31, and the central error signal 26 or the internal error signal 36 is detected at the center. This is because the processing device 21 or the central processing device 31 is unconditionally disconnected from the information processing system 10.

  The error detection / correction circuit 41 performs error detection and correction of the input / output information 24 using error check data 25 redundantly added to the input / output information 24 exchanged with the central processing unit 21. When an uncorrectable error is detected in this error detection and correction, the error detection / correction circuit 41 outputs an uncorrectable error detection signal 41 a to the logical product circuit 46.

  The error detection / correction circuit 42 performs error detection and correction of the input / output information 34 using error check data 35 redundantly added to the input / output information 34 exchanged with the central processing unit 31. When an uncorrectable error is detected in the error detection and correction, the error detection / correction circuit 42 outputs an uncorrectable error detection signal 42 a to the logical product circuit 47.

  The data comparator 43 compares the input / output information 24 input from the central processing unit 21 with the input / output information 34 input from the central processing unit 31. A data mismatch detection signal 43 a is output to the product circuit 45.

  The logical product circuit 44 calculates the logical product of the power error signal 23a (PWR_Err0) input from the power monitoring device 23 and the data mismatch detection signal 43a input from the data comparator 43, and outputs a zero-system failure estimation signal 44a. .

  The logical product circuit 45 calculates the logical product of the power supply error signal 33a (PWR_Err1) input from the power supply monitoring device 33 and the data mismatch detection signal 43a input from the data comparator 43, and outputs a 1-system failure estimation signal 45a. .

  The logical product circuit 46 takes the logical product of the logically inverted signal of the uncorrectable error detection signal 41a input from the error detection / correction circuit 41 and the logically inverted signal of the 0-system failure estimation signal 44a, and outputs the 0-system data valid signal 46a. Is output.

  The logical product circuit 47 calculates the logical product of the logically inverted signal of the uncorrectable error detection signal 42a input from the error detection / correction circuit 42 and the logically inverted signal of the 1-system failure estimation signal 45a, and outputs the 1-system data valid signal 47a. Is output.

  The logical product circuit 48 takes the logical product of the logical inversion signal of the 0-system data valid signal 46 a input from the logical product circuit 46 and the logical inversion signal of the 1-system data valid signal 47 a input from the logical product circuit 47. The data selection control signal 49a is output to the selector 50.

  The logical product circuit 49 takes the logical product of the logical inversion signal of the 0-system data valid signal 46 a input from the logical product circuit 46 and the 1-system data valid signal 47 a input from the logical product circuit 47, and generates a data selection control signal. 49a is output to the selector 50.

  The selector 50 selects the input / output information 34 on the side of the 1-system processing device 30 when the data selection control signal 49a is true (“1”), and the 0-system when it is false (“0”). The input / output information 24 on the processing device 20 side is selected.

  FIG. 3 shows the determination processing of the redundant configuration control device 40 according to the error occurrence status (situation S1 to S8) of each of the plurality of 0-system processing devices 20 and 1-system processing devices 30 performing equivalent operations. .

  That is, in the logic circuit of the redundant configuration control device 40 illustrated in FIG. 2, no error has occurred in the 0-system processing device 20 and the 1-system processing device 30 among the situations S1 to S8 illustrated in FIG. When the comparison result of both the input / output information 24 and the input / output information 34 does not match (the data mismatch detection signal 43a is true), which of the 0-system processing device 20 and the 1-system processing device 30 is to be selected. to decide.

Hereinafter, an example of the operation of the information processing system 10 according to the present embodiment will be described.
As described above, in the present embodiment, the power supply monitoring device 23 provided in the power supply 22 that supplies power to the central processing device 21 and the power supply monitoring device provided in the power supply 32 that supplies power to the central processing device 31. 33, the power supply error signal 23a and the power supply error signal 33a are input to the redundant configuration control device 40.

  The power supply monitoring device 23 and the power supply monitoring device 33 are components capable of high-speed operation because the central processing unit 21 and the central processing unit 31 need to detect a voltage abnormality earlier than when the central processing unit 21 and the central processing unit 31 malfunction due to a decrease in the power supply voltage V. And set the threshold value higher.

 That is, in the present embodiment, the voltage fluctuation detection threshold Vt that is a threshold for abnormality determination in the power supply monitoring device 23 and the power supply monitoring device 33 is the rated voltage V0 and the CPU operable voltage Va as illustrated in FIG. It is set in between and relatively high so as to be close to the rated voltage V0.

  Thus, when the voltage fluctuation detection threshold Vt is set near the rated voltage V0, the power monitoring device 23 and the power monitoring device 33 become very sensitive. It also reacts to slight fluctuations in the power supply voltage V of the power supply 22 and the power supply 32 due to ambient noise or the like.

  Therefore, in the present embodiment, the 0-system processing devices 20 and 1 that are directly provided in a multiple manner using the power supply error signal 23a and the power supply error signal 33a output from the power supply monitoring device 23 and the power supply monitoring device 33. Processing that disconnects one of the system processing devices 30 is not performed.

  That is, the redundant configuration control device 40 performs the parity check or ECC check of the input / output information 24 and the input / output information 34 in each of the 0-system processing device 20 and the 1-system processing device 30 and the internal error signal 26 (Error). Although there is no abnormality in the priority, the power supply monitoring device 23 and the power supply monitoring device are not used until a mismatch occurs between the input / output information 24 of the 0-system processing device 20 and the input / output information 34 of the 1-system processing device 30. The power supply error signal 23a and the power supply error signal 33a are referred to, and the 0-system processing device 20 or the 1-system processing device 30 on the side where the power supply error signal 23a or the power supply error signal 33a indicates an abnormality is referred to as the information processing system 10. The information is processed using the other 1-system processing device 30 or 0-system processing device 20. To continue.

  Therefore, when the input / output information 24 of the 0-system processing device 20 matches the input / output information 34 of the 1-system processing device 30, the power supply error signal 23a and the power supply error signal 33a are ignored.

  The operation of the logic circuit of the redundant configuration control device 40 illustrated in FIG. 2 can also be realized by software such as a control program 70 that controls the redundant configuration control device 40. In other words, the control program 70 includes a check processing logic 71 for monitoring the failure of each of the central processing unit 21 and the central processing unit 31, a check processing logic 72, input / output information 24 of the 0-system processing device 20, and 1-system processing. It includes comparison logic 73 for comparing with the input / output information 34 of the device 30 and selection logic 74 for selecting which of the input / output information 24 and the input / output information 34 to use as the input / output data 51.

The operation of the control program 70 in this case will be described with reference to the flowchart of FIG.
First, referring to the internal error signal 26 and the internal error signal 36 of each of the central processing unit 21 and the central processing unit 31, it is determined whether or not both indicate a failure (step 101). In this case, the ECC / parity check results of the input / output information 24 and the input / output information 34 of both the central processing unit 21 and the central processing unit 31 are further discriminated (step 102).

  If there is no abnormality in both systems, it is determined whether the input / output information 24 and the input / output information 34 of the 0-system processing device 20 and the 1-system processing device 30 match (step 103). If they match, there is no abnormality and the process returns to step 101 (situation S1).

  On the other hand, in the case of a mismatch (NO) in step 103, that is, although no error is detected in both the 0-system processing device 20 and the 1-system processing device 30, the input / output information 24 and the input / output information 34 of both are If there is a discrepancy (situation S2 to S5), there is no basis for selecting either the 0-system processing device 20 or the 1-system processing device 30 in the past, so the information processing system 10 is stopped as a failure of unknown cause. Availability had to be reduced.

  On the other hand, in the case of the present embodiment, when it is determined in step 103 that the input / output information 24 and the input / output information 34 do not match (situation S2 to situation S5), the power error signal 23a is referred to. Then, a power supply voltage fluctuation error on one of the 0-system processing devices 20 side is confirmed (step 104). If there is an error, the power-supply error signal 33a of the other 1-system processing device 30 is further referred to and 1 The power supply voltage fluctuation error on the system processor 30 side is confirmed (step 109), and if there is no error, the input / output information 34 on the system processor 30 side is selected as the input / output data 51 (ie, The 0-system processing device 20 is disconnected from the information processing system 10 and connected to the peripheral system 60 (step 110) (situation S4).

  On the other hand, if it is determined in step 104 that there is no power supply voltage fluctuation error of the 0-system processor 20, the power error signal 33a of the other 1-system processor 30 is referred to and the power supply on the 1-system processor 30 side is referred to. The voltage fluctuation error is confirmed (step 105), and if there is an error, the input / output information 24 of the 0-system processing device 20 is selected (ie, the 1-system processing device 30 side is disconnected from the information processing system 10). ) Continue operation (step 111) (situation S3).

  Further, when the power supply voltage fluctuation error of the 1-system processing device 30 is not detected in Step 105, the power supply voltages of both the 0-system processing device 20 and the 1-system processing device 30 are normal. Both the system processor 20 and the first system processor 30 are determined to be errors (step 106) (situation S2).

  Similarly, if a power supply voltage fluctuation error of the 1-system processing device 30 is detected in step 109, it means that both the 0-system processing device 20 and the 1-system processing device 30 have detected a power supply voltage fluctuation error. In this case, both the 0-system processing device 20 and the 1-system processing device 30 are determined as errors because the cause is unknown (step 106) (situation S5).

  If NO is determined in step 101 described above, that is, if at least one of the internal error signal 26 and the internal error signal 36 is true, both of the 0-system processing device 20 and the 1-system processing device 30 are used. It is determined whether the fault is a serious fault (step 107). If both faults, the process branches to step 106 (situation S8).

  If it is determined in step 107 that one of the 0-system processing device 20 and the 1-system processing device 30 is faulty, the other 1-system processing device 30 or the 0-system processing device 20 is selected and the processing is continued ( Step 108) (Situation S6, Situation S7). The same applies when it is determined NO in step 102 described above.

  As described above, according to the present embodiment, in the information processing system 10 including a plurality of 0-system processing devices 20 and 1-system processing devices 30 that perform equivalent operations, the 0-system processing device 20 and the 1-system processing are performed. If no error is detected in any of the devices 30 and a situation occurs in which the input / output information 24 and the input / output information 34 of the two devices do not match, each of the 0-system processing device 20 and the 1-system processing device 30 Referring to the power supply error signal 23a and the power supply error signal 33a from the power supply monitoring device 23 and the power supply monitoring device 33 that monitor voltage fluctuations of the provided power supply 22 and power supply 32, the side on which the power supply voltage fluctuation error is detected is failed. The information processing system 10 can be separated from the information processing system 10 and the information processing system 10 can be continuously operated using the other. Therefore, the availability of the information processing system 10 is improved.

  In the above description, the case where the fluctuation of the power supply voltage V of the power supply 22 and the power supply 32 is determined using the voltage fluctuation detection threshold Vt in the power supply monitoring apparatus 23 and the power supply monitoring apparatus 33 is exemplified. Not.

For example, within the range of the rated voltage V0 and the CPU operable voltage Va, the fluctuation amounts of the power supply voltages V of the power supply 22 and the power supply 32 are compared. A method of determining an error can also be used.
Needless to say, the present invention is not limited to the configuration exemplified in the above-described embodiment, and various modifications can be made without departing from the spirit of the present invention.

(Appendix 1)
A control method of an information processing system including a plurality of processing devices that perform equivalent operations,
When no error is detected in each of the processing devices and output information from the plurality of processing devices does not match, the processing device on the side where the fluctuation amount of the power supply voltage is relatively large is disconnected from the information processing system. A method for controlling an information processing system.
(Appendix 2)
In the control method of the information processing system according to attachment 1,
The information processing system control method, wherein the error includes an internal error of each of the processing devices and an ECC check error or a parity check error related to input / output data for each of the processing devices.
(Appendix 3)
In the control method of the information processing system according to attachment 1,
A threshold value is set between the rated value of the power supply voltage and an operable voltage at which the processing apparatus can operate normally, and the amount of fluctuation in the power supply voltage is determined based on the threshold value. Control method of information processing system.
(Appendix 4)
A plurality of processing devices performing operations equivalent to each other are provided with power supply voltage monitoring means, and no error is detected in each of the processing devices, but the amount of fluctuation in power supply voltage when the output data from each of the processing devices does not match A control method for an information processing system, wherein a failure has occurred in the processing apparatus on the relatively large side.
(Appendix 5)
In an information processing system including a plurality of first and second processing devices that perform processing equivalent to each other, voltage monitoring for detecting a fluctuation in power supply voltage of each of the first and second processing devices with a threshold value and outputting the detected voltage as a voltage monitoring signal Providing means,
In the case where the output data from the first and second processing devices does not match even though no abnormality is detected in any of the first and second processing devices, the first from the voltage monitoring means And a method of controlling the information processing system, wherein the first or second processing device having an abnormal power supply voltage is disconnected with reference to the voltage monitoring signal of each of the second processing devices.
(Appendix 6)
A control method of an information processing system that causes a plurality of first and second processing devices to perform the same information processing and uses the first or second processing device in which the operating state is sound,
A first step of determining whether or not an error check item other than the power supply voltage relating to the first and second processing devices is normal;
A second step of determining whether or not the outputs from each of the first and second processing devices match when the error check item is normal;
When the outputs do not match in the second step, the first or second process on the side determined as having no abnormality in the error determination based on the variation amount of the power supply voltage of each of the first and second processing devices A third step using the device;
A method for controlling an information processing system comprising:
(Appendix 7)
In the control method of the information processing system according to attachment 6,
The error check items in the first step include an internal error of each of the first and second processing devices and an ECC check error or a parity check error related to input / output data for each of the first and second processing devices. A method for controlling an information processing system.
(Appendix 8)
In the control method of the information processing system according to attachment 6,
In the error determination based on the fluctuation amount of the power supply voltage in the third step,
When the power supply voltage falls below a threshold value set between a rated value of the power supply voltage and an operable voltage at which the first and second processing apparatuses can operate normally, the abnormality of the power supply voltage A control method for an information processing system, characterized by determining.
(Appendix 9)
A plurality of first and second processing devices;
Voltage monitoring means for monitoring fluctuations in the power supply voltage of each of the first and second processing devices;
Selecting means for switching which one of the first and second processing devices to use,
The selection means includes
First determination means for determining whether or not an error check item other than a power supply voltage related to the first and second processing devices is normal;
Second determination means for determining whether or not outputs from each of the first and second processing devices match when the error check item is normal;
When the output is determined to be inconsistent by the second determining means, the first on the side that is determined to have no abnormality in the error determination based on the variation amount of the power supply voltage of each of the first and second processing devices. Or a third discriminating means for selecting the second processing device;
An information processing system comprising:
(Appendix 10)
In the information processing system according to attachment 9,
The voltage monitoring means, when the power supply voltage is lower than a threshold value set between the rated value of the power supply voltage and the operable voltage at which the first and second processing devices can operate normally, An information processing system for determining that the power supply voltage is abnormal.
(Appendix 11)
In the information processing system according to attachment 9,
The error check items performed by the first determination means include an internal error of each of the first and second processing devices and an ECC check error or a parity check error related to input / output data for each of the first and second processing devices. An information processing system comprising:
(Appendix 12)
A control program for an information processing system, comprising: a plurality of first and second processing devices; and a selection means for switching which of the first and second processing devices to use.
In the selection means,
A first step of determining whether or not an error check item other than the power supply voltage relating to the first and second processing devices is normal;
A second step of determining whether or not the outputs from each of the first and second processing devices match when the error check item is normal;
When the outputs do not match in the second step, the first or second process on the side determined as having no abnormality in the error determination based on the variation amount of the power supply voltage of each of the first and second processing devices A third step using the device;
A control program for an information processing system, characterized in that
(Appendix 13)
In the control program for the information processing system according to attachment 12,
The error check items in the first step include an internal error of each of the first and second processing devices and an ECC check error or a parity check error related to input / output data for each of the first and second processing devices. A control program for an information processing system.
(Appendix 14)
In the control program for the information processing system according to attachment 12,
In the error determination based on the fluctuation amount of the power supply voltage in the third step,
When the power supply voltage falls below a threshold value set between a rated value of the power supply voltage and an operable voltage at which the first and second processing apparatuses can operate normally, the abnormality of the power supply voltage A control program for an information processing system characterized by determining.
(Appendix 15)
A redundant configuration control device that monitors a plurality of processing devices provided redundantly in an information processing system and performs an operation of disconnecting the processing device in a fault from the information processing system,
An error is not detected in each of the processing devices, but when the output data from each of the processing devices does not match, it is determined that a failure has occurred in the processing device on the side where the fluctuation amount of the power supply voltage is relatively large A redundant configuration control device comprising control logic.

It is a block diagram which shows an example of a structure of the information processing system which is one embodiment of this invention. It is a block diagram which shows an example of an internal structure of the redundant structure control circuit which comprises the information processing system which is one embodiment of this invention. It is explanatory drawing which shows an example of the determination operation | movement in the redundant structure control circuit which is one embodiment of this invention. It is a diagram which shows an example of the determination operation | movement of the power supply voltage in the redundant structure control circuit which is one embodiment of this invention. It is a flowchart which shows an example of the determination operation | movement in the redundant structure control circuit which is one embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Information processing system 20 0 system processing device 21 Central processing device 22 Power supply 23 Power supply monitoring device 23a Power supply error signal 24 Input / output information 25 Error check data 26 Internal error signal 30 1 system processing device 31 Central processing device 32 Power supply 33 Power supply monitoring device 33a Power error signal 34 Input / output information 35 Error check data 36 Internal error signal 40 Redundant configuration controller 41 Error detection / correction circuit 41a Uncorrectable error detection signal 42 Error detection / correction circuit 42a Uncorrectable error detection signal 43 Data comparator 43a Data mismatch detection signal 44 AND circuit 44a 0 system failure estimation signal 45 AND circuit 45a 1 system failure estimation signal 46 AND circuit 46a 0 system data valid signal 47 AND circuit 47a 1 system data valid signal 48 AND circuit 49 logic Product circuit 49a Data selection Control signal 50 selector 51 output data 60 peripheral systems 70 control program 71 checks processing logic 72 check processing logic 73 compare logic 74 select logic V supply voltage V0 rated voltage Va CPU operable voltage Vt voltage fluctuation detection threshold

Claims (10)

A control method of an information processing system including a plurality of processing devices that perform equivalent operations,
When no error is detected in each of the processing devices and output information from the plurality of processing devices does not match, the processing device on the side where the fluctuation amount of the power supply voltage is relatively large is disconnected from the information processing system. A method for controlling an information processing system. In the control method of the information processing system according to claim 1,
The information processing system control method, wherein the error includes an internal error of each of the processing devices and an ECC check error or a parity check error related to input / output data for each of the processing devices. In the control method of the information processing system according to claim 1,
A threshold value is set between the rated value of the power supply voltage and an operable voltage at which the processing apparatus can operate normally, and the amount of fluctuation in the power supply voltage is determined based on the threshold value. Control method of information processing system.   A plurality of processing devices that perform operations equivalent to each other are provided with power supply voltage monitoring means, and no error is detected in each of the processing devices, but when the output data from the individual processing devices do not match, the amount of fluctuation in the power supply voltage A control method for an information processing system, wherein a failure has occurred in the processing apparatus on the relatively large side. In an information processing system including a plurality of first and second processing devices that perform processing equivalent to each other, voltage monitoring for detecting a fluctuation in power supply voltage of each of the first and second processing devices with a threshold value and outputting the detected voltage as a voltage monitoring signal Providing means,
In the case where the output data from the first and second processing devices does not match even though no abnormality is detected in any of the first and second processing devices, the first from the voltage monitoring means And a method of controlling the information processing system, wherein the first or second processing device having an abnormal power supply voltage is disconnected with reference to the voltage monitoring signal of each of the second processing devices. A control method of an information processing system that causes a plurality of first and second processing devices to perform the same information processing and uses the first or second processing device in which the operating state is sound,
A first step of determining whether or not an error check item other than the power supply voltage relating to the first and second processing devices is normal;
A second step of determining whether or not the outputs from each of the first and second processing devices match when the error check item is normal;
When the outputs do not match in the second step, the first or second process on the side determined as having no abnormality in the error determination based on the variation amount of the power supply voltage of each of the first and second processing devices A third step using the device;
A method for controlling an information processing system comprising: The control method of the information processing system according to claim 6,
In the error determination based on the fluctuation amount of the power supply voltage in the third step,
When the power supply voltage falls below a threshold value set between a rated value of the power supply voltage and an operable voltage at which the first and second processing apparatuses can operate normally, the abnormality of the power supply voltage A control method for an information processing system, characterized by determining. A plurality of first and second processing devices;
Voltage monitoring means for monitoring fluctuations in the power supply voltage of each of the first and second processing devices;
Selecting means for switching which one of the first and second processing devices to use,
The selection means includes
First determination means for determining whether or not an error check item other than a power supply voltage related to the first and second processing devices is normal;
Second determination means for determining whether or not outputs from each of the first and second processing devices match when the error check item is normal;
When the output is determined to be inconsistent by the second determining means, the first on the side that is determined to have no abnormality in the error determination based on the variation amount of the power supply voltage of each of the first and second processing devices. Or a third discriminating means for selecting the second processing device;
An information processing system comprising: A control program for an information processing system, comprising: a plurality of first and second processing devices; and a selection means for switching which of the first and second processing devices to use.
In the selection means,
A first step of determining whether or not an error check item other than the power supply voltage relating to the first and second processing devices is normal;
A second step of determining whether or not the outputs from each of the first and second processing devices match when the error check item is normal;
When the outputs do not match in the second step, the first or second process on the side determined as having no abnormality in the error determination based on the variation amount of the power supply voltage of each of the first and second processing devices A third step using the device;
A control program for an information processing system, characterized in that A redundant configuration control device that monitors a plurality of processing devices provided redundantly in an information processing system and performs an operation of disconnecting the processing device in a fault from the information processing system,
An error is not detected in each of the processing devices, but when the output data from each of the processing devices does not match, it is determined that a failure has occurred in the processing device on the side where the fluctuation amount of the power supply voltage is relatively large A redundant configuration control device comprising control logic.

Images